When a payment instruction is submitted to a real-time payment network, the network has a window — measured in seconds at most — before the instruction is executed and settlement becomes irrevocable. Within that window, the network can evaluate the risk characteristics of the instruction and return a risk signal to the submitting participant. That participant — the sending bank or payment service provider — uses the signal alongside their own assessment to decide whether to execute the payment, hold it for further review, or present the payer with additional information about the transaction.
What the network can assess in that window is different from what the sending participant knows. The sending participant knows the payer — their account, their KYC profile, their transaction history, the session context of the payment instruction. The network knows the receiving side: how the receiving account has behaved as a payment destination across the entire scheme, across all participants, not just within this sending institution’s own transaction history.
Those two perspectives are complementary. The sending participant’s model assesses payer-side risk. The network’s signal contributes payee-side intelligence that the sending participant cannot generate from their own data, because they can only see payments they have sent to that receiving account — not the payments that all other scheme participants have sent to the same account.
What the network can observe about receiving accounts
A receiving account’s behaviour across the scheme is observable at the network level without any knowledge of the account holder’s identity or KYC profile. The signals are transactional:
Inflow velocity: how many payment instructions has this receiving account received from across the scheme in a defined recent period, and how does that compare to its historical receive pattern and to the distribution of similar accounts in the scheme?
Inflow dispersion: are the payments arriving from a narrow set of sending institutions or a broadly dispersed set of participants? A receiving account that suddenly receives payments from a large number of different sending institutions in a short period exhibits a pattern that is inconsistent with normal personal or business payment receipt behaviour.
Outflow correlation: for network participants that process both inbound and outbound payment flows, the speed with which funds received are subsequently transferred onwards is observable as a network-level pattern. Accounts that receive and rapidly redistribute funds across multiple destinations exhibit the behavioural profile of mule accounts regardless of what account-level information any individual institution holds.
Scheme tenure: a receiving account that was added to the network recently and immediately begins receiving a high volume of payments from multiple institutions is exhibiting a pattern inconsistent with the normal ramp-up of a new legitimate payee.
None of these signals require the network to know who the account holder is. They are purely behavioural observations about how the account functions as a node in the payment flow network.
The irrevocability premium on signal quality
The economic value of a risk signal is a function of what action it enables. In reversible payment environments, a post-payment risk signal enables recovery — imperfect and costly, but possible. In irrevocable real-time payment environments, a post-execution risk signal enables documentation of a loss that has already occurred. The only signal that prevents loss rather than recording it is one that arrives before execution.
This means that even a marginal improvement in pre-execution signal quality has a higher economic value in real-time payment contexts than in reversible payment contexts. The network that improves its receiving-account risk model by identifying 5 percent more mule accounts before execution prevents those losses entirely. The equivalent improvement in post-payment detection recovers a fraction of those losses at substantial investigation and recovery cost.
The network’s commercial case for the real-time payment risk signal service rests on this irrevocability premium. Participants managing their exposure on irrevocable rails have a different risk calculus from those managing card transaction disputes. The pre-execution signal is worth more to them per unit of precision improvement, which supports a stronger commercial case for the service than the equivalent precision improvement in a reversible payment context.
What the network does not do
The network does not hold or block real-time payment instructions. That authority belongs to the sending participant — the regulated payment service provider who has a direct relationship with the payer and bears the regulatory and contractual obligations for the payment. The network provides a risk score. The participant makes the decision: execute, hold for review, or present the payer with an information message about the payment risk.
This division of responsibility is not a limitation. It is the correct architecture. The network provides the cross-participant intelligence that the individual participant cannot generate. The participant applies that intelligence alongside their own customer-level assessment. The combination produces better outcomes than either alone, with each party contributing the dimension they are uniquely positioned to assess.
What success looks like
The metrics for the network’s real-time payment risk service are risk score accuracy on receiving account profiles — measured against confirmed mule account and fraud-associated account populations — participant adoption rate, and the measurable reduction in real-time payment fraud losses at participating institutions attributed to the network score. The last metric requires a controlled comparison between participants using the signal and equivalent participants not using it, tracking fraud loss rates on the same payment rail over a defined measurement period.
